Your ID card contains a private key, you use that key to sign a transaction. It doesn't matter that machine you are running on is compromised as these details can be verified at a later date.
Example A: You vote for candidate A, but software changes to candidate B and software displays that you voted for candidate A. At any later time you can check with an independent device and look at the transaction finding out that it was altered with and retract your vote / change it.
Example B: How do you know your vote was counted? Publish a hash and the signature of every vote, recompute the final tally and compare with all the votes. If your vote is not in the final tally the hash will be different and you can visibly see your vote in the dataset as every transaction is published. To preserve privacy each round has a number, private key + number -> new key so each fingerprint will be unique between votes.
I've spent a lot of time thinking about this problem, and my conclusion is that cryptography alone is not the solution, for reasons like:
1. The public needs to believe it, and hypertechnical solutions are a hard sell.
2. Any blockchain approach needs to preserve the secrecy of the ballot, otherwise you get all the problems you can expect of non-secret votes (coercion, vote buying, shaming network effects).
3. You still need to have the cryptographic rubber meet the physical road _somewehere_ -- it has to, otherwise the need for vote secrecy means that the results can be entirely fictitious and pre-programmed and there is no way to check!
I.e., you can have a paperless blockchain solution IFF you abandon vote secrecy. That is a very tough to swallow pill.
On the other hand, if you accept paper ballots and manual partial audits as part of the solution, then blockchain can have a role to play. For example, the machines could display a blockchain head every 50 ballots cast, and voters take a copy of the blockchain head visible to them, then after the election the public can verify the integrity of the blockchain, and the fact that you only get running tallies every 50 ballots means you get vote secrecy.
A system that uses paper ballots and partial manual audits can be explained to the public, and the public can develop confidence in it. Blockchains can then add a good deal of confidence: the blockchain tells you that the tallies were not modified after the fact, and the partial manual audit tells you to an acceptable level of statistical confidence that the digital cast vote record contains the actual paper ballots _as marked and cast_ by voters.
This is false. I know this is a common thought on HN because some formerly popular youtuber did a video about this topic that is still regularly reposted here, but he was already wrong in theory back then and it is certainly wrong in practice today. Secrecy/anonymity and verifiability are no longer mutually exclusive as anyone who is well versed in modern cryptography will be able to tell you.
Also, you still have to convince the public.
There have also been earlier implementations like this one: https://github.com/benadida/helios (corresponding paper https://www.usenix.org/legacy/event/sec08/tech/full_papers/a...), although it still lacked coercion resistance. But it already uses zero knowledge proofs, which is at the core of anonymous yet verifiable systems.
Public doesn't need to know the details. Production of paper, printers is quite complex and so production of the pen. Yet people are not concerned about that when voting and we don't publish schematics of a printer that printed the ballots.
Except that people know what paper looks and feels like, they know how it absorbs ink, they know its various properties, they can _read_ whatever is printed on them, and they can see that the marks they make (or a ballot marking device does for them) are faithfully visible on the paper. With paperless machines there is nothing comparable.
Passports would need to become like hardware wallets with screens such as Trezor. Who's firmware and design are open source.
The screen means I can see what I'm signing and later be shown what I signed.
Now, I don't want people to know who I vote for. So we make it e-passport gate so that no one can enter with me.
Now I want to be able to verify my vote at a later date but not let others know it was me. Well this too is solved by multiple cryptocurrencies like monero and z-cash.
I can go to my local town hall enter a room alone using a e-passport style gate and check my vote at the machine. My device can verify my vote.
Someone with the vote can only see that 1 of N voters did it. Where N is so large they can't identify me.
No duplicate vote is possible.
Literally no one would agree to this however.
- confirms (paper goes down the box) and exits the booth
or
- cancels (paper is burned) and votes again
I can't claim to be a crypto expert.
But hiding a transaction and it's value among other transactions is perfect for voting.
As I understand it Monero uses ring signatures to make it so it's not possible to know which individual of a group initiated a transaction, and it's zero knowledge proof system means it can be verified that a particular transaction is valid despite this.
To my layman mind that seems to be good enough, every vote can be verified by any party as valid (no double spending or double voting took place).
You can never narrow down who made a particular vote beyond a large pool of people.
You can't tell where any transaction went (you don't know who was voted for).
At the same time with my private key I can see my vote.
The only thing needed for voting is the e-passport style gates.
Certainly it won't just get a case of use monero, they would need to design the system for voting.
Since I'm able to retract my vote, I cannot sell it. And since I can retract my vote, I cannot be coerced in any way.
This enables coercion of voters. It must be impossible to attribute any vote to any specific person.
This implies there is a record establishing a relationship between person A and vote X.
The fact most people won't bother to check it in practice is irrelevant. It must be impossible, because otherwise people are going to die.
There is no problem that electronic voting solves that paper ballots and scanners do not, and the latter are not only more secure but are seen to be more secure. Trust is essential in a voting system and only paper ballots provide the necessary level of trust.
There is a specific problem with mail-in voting and disabled voters, for example elderly people who can't go to the polls and can't get an electronic ballot marker. 25 US states deliver ballots electronically and 15 allow electronic voting for this specific case [1].
[1] https://www.ncsl.org/elections-and-campaigns/electronic-ball...
You also have issues of deanonymization if you only get a couple of ballots in via one method. In Maryland, for example, they're supposed to encourage at least 100 random people to use the accessible ballot marker per precinct for this reason.
It's not reasonable to tell people "too bad," fly back to the US as much as 3 times per year. They pay taxes and are subject to US law even though they're overseas, so they get to vote.
Ballot management becomes error prone. My county alone has 25 ballots due to the different combinations of state house, senate, Federal house, municipalities, and _all_ the special districts. (4 members to the board of directors of the Anytown West Memorial District, a.k.a. cemetery, because they had a property tax assessment when they built the thing in 1950)
I offered nothing of the kind, except as to civilians residing abroad, and even then, I don't think there should be any obligation to provide online voting -- having to travel to a consulate is not too unreasonable.
> It's not reasonable to tell people "too bad," fly back to the US as much as 3 times per year. They pay taxes and are subject to US law even though they're overseas, so they get to vote.
Vote... where? In what state, in what county, in what precinct? The correct answer is that they should not have to pay income taxes while residing abroad, but also not get to vote while residing abroad.
For military the situation is simpler even if the personnel have no US-side residence: use the state/county/precinct of last residence. The same can apply to civilians, but I'd rather let them not pay state and federal income taxes while residing abroad.
> Ballot management becomes error prone. My county alone has 25 ballots due to the different combinations of state house, senate, Federal house, municipalities, and _all_ the special districts. (4 members to the board of directors of the Anytown West Memorial District, a.k.a. cemetery, because they had a property tax assessment when they built the thing in 1950)
That's a small county :)
Or ballot boxes. Where citizen can keep their eyes on their ballot until it is counted.
Even back in 2002, TV channels in France (60m inhabitants) broadcast the winner at 20:00:30, using statistical models.
But recently, they removed the ability for citizen to stay during the counting, relying on designated persons, which breaks the chain of trust. Might as well cast my vote into a black bag or an electronic machine, no trust at all.
Trust was never the goal. As the means of coercion are higher and the capacity of communication is filtered, it becomes unnecessary to involve citizen in voting, isn't it?
Here in Australia, representatives of the various political parties observe the counting as scrutineers. I did it once. It’s absolutely fascinating seeing the system and rules. All (lower house) votes are physical slips of paper. Officials sort them into piles of 50 based on their first preference, in a big warehouse. Scrutineers watch them do it. We are allowed to contest their reading and sorting of a vote, but not physically touch anything.
I’m sorry to hear you can’t see your own democracy in action. I have more trust in our election process seeing it up close, in person.
In the end, you always must trust humans.
Naive solutions have naive problems.
This seems to make a pretty dramatic change to the election protocol, no?
Consider example A': You vote for candidate A, but later realize that you hate candidate A. You repudiate your recorded vote for candidate A.
What should happen?
Or is this a knee-jerk America Bad?
Only a selected few orgs and groups are allowed to audit and in a very controlled environment because they also rely on security through obscurity. The source code is not available to the citizens.
If by any chance I'm wrong and someone can point me a source code repo, please enlighten me.
https://international.tse.jus.br/en/electronic-ballot-box/pr...
You just need to find the right balance.
In my country we still rely on a paper process - which is very hard to tamper with but also has a bunch of problems - recently we needed to repeat local state elections because of such problems including shortages of ballot papers, unusually long queues to vote, ballots being delivered to the wrong locations, and in some cases voters being turned away. Many of these problems go away with digital voting - but then you have other issues.
I don’t think a perfect solution can exist
Not even a remote access to a demo ballot machine.
Our congress has determined that a paper trail must be implemented but the judges aren't having it.
https://news.ycombinator.com/item?id=36543423
Source code is a red herring too. If there's no reproducible builds that cryptographically establish source-executable correspondence, showing us the source code would prove nothing and only serve to embarrass us. Supply chain attacks could compromise it without any source code vulnerability. What they need to do is publish the signed executables that ran on election day as well as every executable used to construct those artifacts. Our AIs will make short work of the binaries.
In any case, the prevailing theory is that the mesários are partidarian and simply impersonate people who didn't show up to vote in order to boost their candidate's numbers. Very low tech, can be fixed with surveillance: have people from all parties everywhere observing everything. It boggles my mind that this isn't being done already.
That means it doesn't matter one bit how correct you are if the regular Joe does believe you tricked. Adding computers into the mix always makes this worse. And again, this is not something you can fix with clever solutions and cryptography (that admittedly fascinates me nonetheless), the problem is that people can't see electricity generally and I something at the scale of a computer, even if you could it would be utterly meaningless.
This is why the paper ballot system is so glorious in its stupid inefficiency, because it spreads the trust in a way any adult who has mastered object permanence can verify for themselves. Invite the conflicting parties to monitor and have them begrudgingly admit their defeat in the face of the simple, inefficient but agreeable process.
This is why I as a cryptography fan, programmer and hardware guy think electronic voting is not up to the task for high stakes elections.
What is the goal? Having fancy crypto or people being confident about elections?
If spreading the trust is the goal what makes you say "inefficient". It is orders of magnitude better then any crypto system.
The costliest item is counting by hand, so... don't. Use ballot scanning and counting machines and then implement a timely partial manual audit to demonstrate that the BMDs and BSCDs functioned correctly.
Automating any of the process is (imho) harmful to above.
While I’m a proponent of the paper process let’s not pretend it immediately means you can be confident about the election
With some abstract math and computers? Any real or imaginary issues are incomprehensible to most of the voters and concerns can be easily shooed away.
I mean that's too abstract and philosophical of a problem when talking about voting machines/software: there are much more prevalent and concrete risks including but not limited to APT-grade breach/espionage if your country is important enough, and the various other issues (some in your comment itself).